Void Arachne

Also known as Silver Fox

Void Arachne is a threat actor group targeting Chinese-speaking users with malicious MSI files containing legitimate software installers for AI software. They exploit public interest in VPN technology and AI software to distribute malware through SEO poisoning and Chinese-language-themed Telegram channels. The group's campaign includes bundling malicious Winos payloads with deepfake pornography-generating AI software and voice-and-face-swapping AI software. Void Arachne also promotes AI technologies for virtual kidnapping and uses AI voice-alternating technology to pressure victims into paying ransom.

Recent activity

• Then they made 2,500+ variants by changing 8 bytes (the PE checksum and the certificate padding). Every file hash is different, and the signature stays valid. C
  mastodon · Nov 4, 2026
• @ netresec (Erik Hjelmvik) retrohunted a WhatsApp VBScript campaign and found a .vbs pulling a dropper from Backblaze B2. The dropper deployed NSecRTS.exe, the
  mastodon · Oct 25, 2026

References

• https://www.trendmicro.com/en_us/research/24/f/behind-the-great-wall-void-arachne-targets-chinese-speaking-user.html

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.